@sealant/sdk 0.22.0 → 0.24.0

package/dist/effect/api-client.d.ts

@@ -1122,7 +1122,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly registryId: string;
             readonly repository: string;
             readonly tag: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1190,7 +1190,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly repository?: string | undefined;
             readonly tag?: string | undefined;
             readonly runtime?: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -1225,7 +1225,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly workspaceId: string;
             readonly attemptId: string;
             readonly runtime: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -1248,7 +1248,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly triggerType: "api" | "manual" | "retry" | "schedule";
                 readonly triggerRef?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -1309,7 +1309,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly repository?: string | undefined;
                 readonly tag?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2492,7 +2492,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly registryId: string;
             readonly repository: string;
             readonly tag: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -2560,7 +2560,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly repository?: string | undefined;
             readonly tag?: string | undefined;
             readonly runtime?: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2595,7 +2595,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly workspaceId: string;
             readonly attemptId: string;
             readonly runtime: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2618,7 +2618,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly triggerType: "api" | "manual" | "retry" | "schedule";
                 readonly triggerRef?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2679,7 +2679,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly repository?: string | undefined;
                 readonly tag?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";

package/dist/effect/operations.d.ts

@@ -36,7 +36,7 @@ export declare const createWorkspaceOp: (payload: {
     readonly registryId: string;
     readonly repository: string;
     readonly tag: string;
-}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
 export declare const getWorkspaceOp: (workspaceId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly workspaceId: string;
     readonly name: string;
@@ -46,7 +46,7 @@ export declare const getWorkspaceOp: (workspaceId: string, ownerUserId?: string
     readonly repository?: string | undefined;
     readonly tag?: string | undefined;
     readonly runtime?: {
-        readonly adapter: "docker" | "k3s" | "k8s";
+        readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
         readonly resourceId: string;
         readonly reference: string;
         readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -82,7 +82,7 @@ export declare const listWorkspacesOp: (query: {
         readonly repository?: string | undefined;
         readonly tag?: string | undefined;
         readonly runtime?: {
-            readonly adapter: "docker" | "k3s" | "k8s";
+            readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
             readonly resourceId: string;
             readonly reference: string;
             readonly status: "failed" | "pending" | "ready" | "running" | "stopped";

package/dist/facade/session.js

@@ -3,18 +3,19 @@ import { closeSessionOp, getSessionOp, getSessionOutputOp, resizeSessionOp, send
  * Open the held-WebSocket terminal attachment (the data plane). One socket:
  * binary frames are PTY bytes in both directions, text frames are control
  * JSON (`{"t":"resize",...}` up, `{"t":"end"}` down). Auth rides the connect —
- * `?token=` for apiKey clients (WebSocket cannot set headers), `?ownerUserId=`
- * for host-local — and never repeats per event.
+ * `?ownerUserId=` always, plus `?token=` for apiKey clients (WebSocket cannot
+ * set headers; a service principal needs the owner assertion *and* its key) —
+ * and never repeats per event.
  */
 const openAttachment = (ctx, sessionId, options) => {
     const config = ctx.config;
     const url = new URL(`/v1/sessions/${sessionId}/attach`, config.baseUrl);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     url.searchParams.set("from", (options?.from ?? 0n).toString());
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
-    else {
+    // The owner assertion always rides the URL; a service principal needs it *alongside* its key,
+    // and WebSocket cannot carry headers, so the key rides the URL too.
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
+    if (config.apiKey !== undefined) {
         url.searchParams.set("token", config.apiKey);
     }
     return new Promise((resolve, reject) => {
@@ -126,9 +127,7 @@ async function* streamOverSse(ctx, sessionId, from, signal) {
     const fetchImpl = config.fetch ?? fetch;
     const url = new URL(`/v1/sessions/${sessionId}/output/stream`, config.baseUrl);
     url.searchParams.set("from", from.toString());
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
     const response = await fetchImpl(url, {
         headers: {
             accept: "text/event-stream",

package/dist/facade/workspace.js

@@ -214,10 +214,10 @@ const openForward = (ctx, workspaceId, port, options) => {
     if (options?.protocol === "udp") {
         url.searchParams.set("protocol", "udp");
     }
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
-    else {
+    // The owner assertion always rides the URL (a service principal needs it alongside its
+    // key, and WebSocket cannot carry headers — same contract as the session attach).
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
+    if (config.apiKey !== undefined) {
         url.searchParams.set("token", config.apiKey);
     }
     return new Promise((resolve, reject) => {

package/dist/internal/blueprint.js

@@ -4,7 +4,8 @@
  * no contract change. The public `repository` is the SOURCE git repo (it becomes
  * `spec.sources.workspace.url`); the contract's `repository`/`tag` are the OCI push coordinates, which
  * we derive. `customization.enableSealantd` is forced on (it bakes + launches the daemon the run path
- * connects to), the runtime target is pinned to docker (the only bridgeable adapter today), and the
+ * connects to), the runtime target is `auto` (the deployment's default adapter — Docker on self-host, Kubernetes
+ * when the worker is configured for a cluster), and the
  * foreground is a keepalive so the workspace idles with the daemon up and the harness is exec'd on
  * demand by `run()` rather than launched at boot. `options.credentials`, if present, is lowered via
  * `mapWorkspaceCredentials` (see `./credentials.js`) and folded into `spec.credentials`; the control
@@ -123,6 +124,12 @@ export const buildCreateWorkspaceRequest = (options, config) => {
                 })),
             }),
         ...(userEnv === undefined || Object.keys(userEnv).length === 0 ? {} : { userEnv }),
+        ...(options.envFrom === undefined || options.envFrom.length === 0
+            ? {}
+            : { envFrom: options.envFrom.map(({ kind, name }) => ({ kind, name })) }),
+        ...(options.kubernetes?.serviceAccountName === undefined
+            ? {}
+            : { kubernetes: { serviceAccountName: options.kubernetes.serviceAccountName } }),
     };
     const spec = {
         version: "1",
@@ -182,7 +189,9 @@ export const buildCreateWorkspaceRequest = (options, config) => {
             os: options.baseImage !== undefined
                 ? { family: "custom", mode: "require", baseImage: options.baseImage }
                 : { family: options.os ?? "fedora", mode: "prefer" },
-            runtime: { family: "docker", mode: "require" },
+            // `auto` = the deployment's DEFAULT_RUNTIME_ADAPTER. SDK callers don't know (and must not
+            // care) whether the control plane runs workspaces as containers or Pods.
+            runtime: { family: "auto", mode: "prefer" },
         },
         lifecycle: {
             startup: { foreground: { kind: "command", run: "sleep infinity", shell: "bash" } },

package/dist/types.d.ts

@@ -188,6 +188,12 @@ export interface WorkspaceServicesOptions {
      */
     readonly docker?: boolean;
 }
+/** One cluster env source: a Kubernetes object whose keys become workspace environment. */
+export interface WorkspaceEnvFromSource {
+    readonly kind: "secret" | "configmap";
+    /** Kubernetes object name (DNS-1123 subdomain) in the platform's workspaces namespace. */
+    readonly name: string;
+}
 export interface CreateOptions {
     /**
      * Source git repository to build the workspace around (e.g. `"github.com/acme/billing-service"`).
@@ -255,6 +261,31 @@ export interface CreateOptions {
      * instead). Docker runtime only.
      */
     readonly secretEnv?: Readonly<Record<string, string>>;
+    /**
+     * Cluster env sources — Kubernetes runtimes only. Each entry names one Kubernetes `Secret` or
+     * `ConfigMap` in the platform's workspaces namespace whose KEYS become workspace environment,
+     * resolved by the platform worker at workspace creation (a launch keeps its snapshot across
+     * container restarts; rotation reaches only later launches). Ordered, last wins across kinds.
+     * Only objects the operator opted in with the `sealant.sh/workspace-env: "true"` label
+     * resolve; platform-managed objects are refused unconditionally. Explicit `env` / `secretEnv`
+     * and platform-owned names always win over bound keys; bound Secret values ride the transient
+     * secret channel and are masked in captured output. On a deployment whose workspaces do not
+     * run on Kubernetes, create is refused synchronously with the stable error code
+     * `runtime-env-references-unsupported` — no workspace is created.
+     */
+    readonly envFrom?: readonly WorkspaceEnvFromSource[];
+    /**
+     * Kubernetes-runtime-only settings. `serviceAccountName` is an explicit TRUST GRANT: the
+     * workspace Pod runs under it, and with IRSA / Workload Identity the session agent holds that
+     * role's full permissions for the whole session — bind a least-privilege role intended for
+     * untrusted code. Honored only against the install's allowlist
+     * (`SEALANT_K8S_ALLOWED_WORKSPACE_SERVICE_ACCOUNTS`); other names fail the launch readable.
+     * The Kubernetes API token is never automounted regardless. Non-Kubernetes deployments refuse
+     * at create time with `runtime-env-references-unsupported`.
+     */
+    readonly kubernetes?: {
+        readonly serviceAccountName?: string;
+    };
     /** Runtime-managed services that need more than installing an OS package. */
     readonly services?: WorkspaceServicesOptions;
     /** When true (default), resolve only once the workspace runtime is live. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.22.0"
+    "@sealant/api-contracts": "^0.24.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",